A device whose system is no longer up to date is an easy way in for an attacker: the flaws are public, and so are the attacks that exploit them. Until now, you could see your employees' devices and use them as Smart Groups for Studio courses. The Sonar rule "Unpatched devices" goes further: it spots the devices concerned and asks each employee to update them.
👍 Good to know: the rule is included in the free Sonar plan. It requires Cyber Missions: it is not available on Karma. See Sonar rules to understand the rules system.
1️⃣ How the rule works
👉 1. Riot checks the devices
Riot checks every device your employees use to sign in to Google or Microsoft, whether it belongs to the company or is personal.
👉 2. Riot spots risky systems
A device is flagged when its operating system has a critical flaw, or is no longer supported (the system is no longer patched by its publisher).
👉 3. The employee updates
They receive a single task in their next mission, covering all their affected devices.
👉 4. Riot checks the update
The next daily check confirms the update. If a device is still out of date, the task comes back in the following mission.
👉 5. You follow the result
You see every flagged device and its status.
2️⃣ Prerequisites
💡 Prerequisites:
be logged in to hub.tryriot.com with an account that has Admin access;
have turned on device synchronisation in the Google or Microsoft integration (see Synchronize your device fleet (Devices) & launch the DarkSword course);
have enabled Cyber Missions on your workspace (the rule is not available on Karma).
3️⃣ Enabling the rule
👉 Step 1: log in to hub.tryriot.com with your Admin account.
👉 Step 2: open the Sonar -> Rules module, then the list of rules.
👉 Step 3: click the "Unpatched devices" rule and turn it on.
4️⃣ Following the flagged devices
The rule's page shows every flagged device with its status.
5️⃣ The employee experience
The employee receives a single task, in their next mission, however many devices are affected.
The task covers all their flagged devices, whether they belong to the company or are personal.
Riot's daily check then confirms the update.
If a device is still out of date, the task comes back in the following mission.
6️⃣ Frequently asked questions
👉 Which devices are covered?
All devices used to sign in to Google or Microsoft, whether supplied by the company or personal. Device synchronisation must be turned on.
👉 When is a device flagged?
When its operating system has a critical flaw, or is no longer patched by its publisher.
👉 Will an employee be asked several times?
They receive a single task, in their next mission, covering all their devices. The task only comes back if a device is still out of date at the next check.
👉 I can't see the rule in Sonar. Why?
Check that device synchronisation is active and that your workspace uses Cyber Missions: the rule is not available on Karma.
Key takeaways
The "Unpatched devices" rule spots devices whose system has a critical flaw or is no longer supported.
The employee receives a single task, in their next mission, covering all their devices.
A daily check confirms the update. The task comes back if a device is still out of date.
You follow every flagged device and its status.
The rule is included in the free Sonar plan and requires device synchronisation and Cyber Missions.